CVE-2026-121952 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeRDP's proxy component accepts a bitmap cache v2 capability value below five but then writes to fixed cell indices 0 through 4, causing out-of-bounds heap writes. A connecting client can corrupt heap memory, leak heap data to the backend, or crash the proxy.
first public Oct 20, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams running the FreeRDP proxy, which sits between RDP clients and a backend, are exposed because a connecting client controls the bitmap cache capability values. Installations that use FreeRDP only as a client, without the proxy, are not described as affected by the sources.
Not affected if client-only-use, proxy-not-deployed
Who cares freerdp, proxy, rdp, self-hosted
xfreerdp --version or the package manager, and see whether it is below 3.32.2.3.32.2 or laterFreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a crash.
This page as .md · .json · in your agent: get_signal("CVE-2026-121952") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.